Remote Support Platform: Secure Access to a Mixed Windows Estate

The Client & Their Context

The client supports a Windows estate spread across their own customers' sites, running Windows 7, 10 and 11, some of it on low-spec hardware. Diagnosing a fault meant a phone call or a site visit. They wanted a remote support tool of their own, built for a single support organisation and running on a server they provide.

The Problem

Technicians need to see and control a customer's machine from anywhere without the person at the other end needing any technical skill and without anyone reconfiguring a router. The moments that matter most are the ones cheaper tools fail at: the Windows logon screen, the lock screen and UAC prompts, where the picture typically goes blank. And the client's own customers then asked for access to their machines too, which means one system has to give the support team the whole estate while giving each customer theirs and nothing else.

What We Built

• A directory service on ASP.NET Core for a client-owned Linux server: identity, the machine register, authorisation of every connection, presence and connection signalling. It is the phone book, not the pipe. Session content never passes through it except on the relay path, where it is end-to-end encrypted and the server cannot read it.
• Peer-to-peer sessions over WebRTC with NAT traversal, so neither end needs router or firewall configuration, and a relay fallback for networks where a direct connection cannot be made. Every session shows the technician whether it is direct or relayed, so a slower session has a visible explanation.
• A customer app split into a Windows service, a session helper and a tray app. The service starts before anyone signs in and moves the helper into whichever desktop is on the console, so the technician's view follows through sign-in, lock and UAC prompts without reconnecting, and a restart reconnects on its own.
• A separate screen-capture path for Windows 7, which lacks the capture API newer versions use, with the screen carried as a standard H.264 video track so every client can render it natively.
• A Windows technician app in WPF: an estate-wide machine list with search and live online state, several sessions open at once, file transfer in both directions that resumes after an interruption, text clipboard sync, and an exportable per-customer access report in PDF and CSV.
• Estate control that does not depend on the remote machine co-operating: customer onboarding and offboarding, and removal of a machine enforced by the server, so a lost or stolen machine can be cut off whether or not it is switched on.
• Customer accounts, added mid-build at the client's request: a customer signs in to the same app and sees their own machines and no one else's. The restriction is applied by the server on every request that touches a machine, never by the app hiding rows, and each route has a test proving another customer's machine is invisible.

Outcome & Scale

• Every requirement in the specification carries an ID, and that ID is written into the code beside whatever implements it, so what is and is not yet built can be listed from the code itself rather than from memory.